Lines of code
<https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/mixins/LiquidityMining.sol#L277-L280&gt;

Vulnerability details

Impact

Rounding errors could occur if the provided amount is too small,

#Proof of Concept
<https://github.com/code-423n4/2023-10-canto/blob/main/canto_ambient/contracts/mixins/LiquidityMining.sol#L277-L280&gt;

                rewardsToSend += inRangeLiquidityOfPosition * concRewardPerWeek_[poolIdx][week] / 
overallInRangeLiquidity;


uint256 rewardsForWeek = (timeWeightedWeeklyPositionAmbLiquidity_[
                    poolIdx
                ][posKey][week] * ambRewardPerWeek_[poolIdx][week]) /
                    overallTimeWeightedLiquidity;

If the users amount is comparatively small and the total amount of liquidity is big then the numerator will be smaller than the denominator. This will cause a rounding error to 0 rewards for the user.

Tools Used

VS Code

Recommended Mitigation Steps

Add a minimum and maximum liquidity that a user can provide.

Assessed type

Decimal

The text was updated successfully, but these errors were encountered:

All reactions